Using a PLC with Wireshark can give me no information if there isn't reverse protocol information.

I searched over internet if anywhere siemens explain this feature, it's very important to know if a set/reset/invert bit in a word requires one or two operations (read - modify - write) at the PLC from the HMI.

If is the second possibility then the scenario is like the interrupt work when special careful will be taken in order to use shared vars between the main and interrupt subroutines.